Enterprise security for everyone
Container isolation with the dangerous capabilities dropped, a web application firewall, behavioural bot protection at the origin, and real-time malware scanning. No security tier, no add-ons - it is how every account is built.
14 days free. No credit card. No commitment.
Isolated
A container per account
No add-ons
Security and backups built in
99.99%
Uptime, last 12 mo
Daily
Backups kept up to 30 days
210+
Tasks Ellie handles
Isolation
Inside your container
Shared hosting usually means a folder with different permissions. This is the configuration each account's container is started with - the specifics, because on a security page the specifics are the argument.
Privileges cannot grow
Containers start with no-new-privileges set, so a process inside can never acquire more than it began with - setuid binaries included. Whatever an exploit lands as, it stays.
The dangerous capability is dropped
SYS_ADMIN - the capability that unlocks mounting, namespace manipulation and most of the interesting container-escape research - is dropped outright. What remains is the minimum the container needs to run.
Nothing executes from writable space
Your home directory is mounted noexec and /tmp is a noexec tmpfs. An attacker who manages to upload a binary cannot then run it, which removes the second half of most upload-based attacks.
Resources are bounded per account
Each container sits in its own systemd cgroup slice with its own CPU, memory and I/O limits. A neighbour under load, or being attacked, cannot take your share.
It comes back on its own
Containers are set to restart always. A crash - yours or something we caused - is measured in seconds, without anybody needing to notice first.
Defence in depth
Three places an attack gets stopped
Layers only count if they fail independently. These do: getting past the firewall does not help you past the container, and neither helps against a stolen password.
Before it reaches your code
Behavioural bot protection
Every request is scored in real time on how it behaves rather than what it claims to be, with challenges for the suspicious and bans that propagate across the fleet. It runs at the origin, so it also catches what a CDN in front of you would have waved through.
ModSecurity with the OWASP rules
The web application firewall sits in front of your application and blocks the classics - SQL injection, cross-site scripting, traversal - before your code ever parses the request. Per-site exclusions when a rule fights your app.
Rate limiting per subdomain
Set limits per site rather than per server, with your own whitelist for the addresses that should never be throttled. This is what stops credential stuffing against a login form.
IP, range and country blocking
Block a single address, a CIDR range, or an entire country from the panel. Datacenter traffic and AI crawlers each have their own switch, because the answer for those is rarely the same as for people.
On the server
A container per account
Not a folder with different permissions. Each account is a real podman container with its own process space, its own filesystem view and its own resource ceiling - the flags are listed above.
SELinux enabled and enforcing
The hosts run with SELinux on rather than switched off to make a control panel work, which is more than most shared hosting can say. Policy exceptions exist where the stack needs them, and the isolation guarantees above do not depend on them.
Real-time file scanning
A filesystem watcher queues files for scanning as they are written, not on a nightly sweep, and known-bad patterns are flagged within seconds of appearing rather than the next morning.
WordPress vulnerability matching
Your installed plugins and themes are matched against published CVEs, so you find out that the thing you installed two years ago now has a known hole - and can update it from the same screen.
Dependency scanning for deployed apps
Every build records the packages it actually installed, and they are re-checked nightly against OSV, the public advisory database. An advisory published months after your last deploy still reaches you, with the version that clears it and whether the package serves requests or only built them.
Around your account
Passkeys, not just passwords
Sign in with a passkey - Touch ID, Windows Hello, a hardware key - and there is no shared secret left to phish or reuse. Available on your account today.
SSH keys pinned to addresses
Every key can be restricted to the IPs allowed to use it, so a stolen key is not automatically a working key. Keys are managed and revoked from the panel.
An audit log of every change
Every create, update and delete is recorded with who did it, when, and what the value was before and afterwards. Searchable, and it covers Ellie as well as people.
Delegate access without sharing a login
Give a developer, an agency or your accountant their own login instead of your password. Choose the hosting accounts they reach and set each feature to view or edit - or share only your invoices. Their actions are theirs in the audit log, and revoking them takes effect on their next click without changing your own credentials.
The layer we built ourselves
Bot protection built into the server
Most hosts buy this from a CDN. Ours scores every request at the origin, which means it also sees what a CDN passes through - and it is on for every account from the first day.
Blocklists tell you where an address has been. Behavioural scoring watches what it does on your site - the pace, the order of the paths, whether it keeps a cookie, whether it can run the challenge it was handed - and decides from that.
It is the part of the platform we have put the most work into, it has its own page, and Ellie will drive the whole thing for you in plain English.
Included, on, and not a tier
- Every plan
- On by default
- Nothing to install
- No plugin overhead
- Per-site tuning
Straight answers
What this does not do
A security page that only lists wins is a sales page. These are the limits worth knowing before you rely on any of it.
Shared hosting is shared
Your files and processes are isolated. The machine underneath is not exclusive to you. If you need single-tenant hardware, that is a different product from a different kind of provider.
Your application is still yours
We can block the request that carries an attack and refuse the binary that arrives with it. We cannot fix an unpatched plugin or a leaked admin password. Most compromises we see arrive through the application, logged in and looking legitimate.
Backups are the last layer, and they are on
Everything above reduces the chance of a bad day. Daily backups on independent servers are what makes a bad day survivable, which is why they are on every plan rather than sold as an add-on.
Pricing
Simple, transparent pricing
Every plan includes managed WordPress, SSH access, daily backups, and enterprise-grade security. Start with a 14-day free trial.
Black Friday80% off your first year with code BLACKFRIDAY80Ends Cyber Monday, November 30
Startup
Great for growing businesses
$7.92
$19.00 for your first year, then $94.99/yr
- 1 website
- 10 GB storage
- ~10,000 visits/month
- 5 MySQL databases
- 250,000 inodes
- 5 FTP users
What's included:
SSL & Domain
- Free SSL certificate
- Free starter domain
- 2 mailboxes
- 3 GB per mailbox
- Webmail, IMAP and SMTP
Advanced
For professional websites
$15.00
$36.00 for your first year, then $179.99/yr
- 5 websites
- 20 GB storage
- ~110,000 visits/month
- 10 MySQL databases
- 500,000 inodes
- 10 FTP users
Everything in Startup, plus:
- 5 mailboxes
- 5 GB per mailbox
Backups
- 14 days of backup history
Performance
- Memcached object cache
- Redis object cache
Pro
Maximum performance and features
$22.92
$55.00 for your first year, then $274.99/yr
- 10 websites
- 40 GB storage
- ~200,000 visits/month
- 20 MySQL databases
- 750,000 inodes
- 20 FTP users
Everything in Advanced, plus:
- 10 mailboxes
- 10 GB per mailbox
Deployment
- 2 SSR applications
Backups
- 30 days of backup history
Monitoring
- 1 minute between checks
For new customers on annual plans. Enter the code at checkout, or when you upgrade a free trial before the sale ends. The 80% comes off your first year; renewals are at the plan's regular price. Ends 11:59 p.m. Eastern on Monday, November 30.
Security included
Every plan, every layer
Container isolation, the firewall, bot protection, malware scanning, SSL and daily backups are in every plan. There is no security tier to upgrade to, because there is nothing held back.
Questions